Keeping sensitive data inside application code

Question

I have an application build in asp.net mvc.

This application stores sensitive encryption keys used by various methods.

However, somebody can easily read the security keys i use if they open the application dll using .NET Reflector

My question is:

The only solution of keeping these keys really secure is to use an obfuscation tool?

Are there other solutions?

dot net reflector print screen

If somebody can get the application DLL, then they sure can read the web.config file — Catalin
– Catalin, Commented May 15, 2013 at 14:56
I don't understand. Who are you trying to hide the information from? External users? Users inside your organization? It is a web application, nobody outside your organization can even access the dll. — Shai Cohen
– Shai Cohen, Commented May 15, 2013 at 14:57
@ShaiCohen: I am trying to hide the information from hackers access :). The application has sensitive data that i can't let it easily be hijacked. — Catalin
– Catalin, Commented May 15, 2013 at 15:02

Community · Accepted Answer · 2017-05-23 12:03:26Z

3

You can encrypt and decrypt them using DPAPI (ProtectedData class in .NET).

Since this is a web app, you can even easier and transparently encrypt the web.config or sections of it

See Encrypting Web.Config

edited May 23, 2017 at 12:03

CommunityBot

11 silver badge

answered May 15, 2013 at 14:58

Martin Ernst

5,6992 gold badges20 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Catalin Over a year ago

I know this is crazy, but if i use DPAPI to encrypt/decrypt web.config file, then the encryption algorithm can be also stolen?

Martin Ernst Over a year ago

If you use DPAPI to encrypt the web.config, you can encrypt it so that only the user that your website runs under can decrypt it. This means that for someone to steal your encryption algorithm, they would have to be able to login as the account that your website runs under, and that you can make very difficult

Collectives™ on Stack Overflow

Keeping sensitive data inside application code

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related